BIOC
Informational
✕
Sudoers discovery
Attackers may enumerate the sudoers file or use the 'sudo -l' command to discover user privileges.
- Module:
- Platform Analytics
- Agent event type:
- Process execution
- Category:
- Discovery
- Status:
- Enabled
ATT&CK tactics: Discovery (TA0007) Privilege Escalation (TA0004)
ATT&CK techniques: Account Discovery (T1087) Abuse Elevation Control Mechanism: Sudo and Sudo Caching (T1548.003)
Indicator:
Process action type = execution AND target process cmd = */etc/sudoers* , *sudo *-l* , *sudo *--list* Process initiator cmd != *chef* AND *puppet* AND *salt-minion* AND cgo cmd != *chef* AND *puppet* AND *salt-minion* AND initiated by != chef-client AND BESClient AND crod AND crond AND cgo name != chef-client AND BESClient AND crod AND crond
Preventable: yes